This Data Processing Agreement ("DPA") is incorporated into and forms an integral part of the Terms of Service or Master Subscription Agreement (the "Principal Agreement") between Rezfiliate Inc. ("Processor") and the Merchant ("Controller"). This DPA applies whenever the Processor processes Personal Data on behalf of the Controller in connection with the Service. In the event of any conflict between this DPA and the Principal Agreement, the provisions of this DPA shall prevail.

This DPA applies to all Personal Data processed by the Processor on behalf of the Controller, regardless of the location of the data subject, to the extent required by applicable law.

Processor Contact Details:
Rezfiliate Inc.
271 Grey Silo Rd, Waterloo, ON N2K 0E9
Contact form: rezfiliate.com/contact

EU / UK Representative: Where required by applicable data protection law, Rezfiliate Inc. will appoint and maintain an EU and/or UK representative and provide the representative's contact details in this Privacy Policy.

Acceptance: By using the Service, the Controller accepts this DPA through a click-wrap agreement (checkbox confirmation) during account creation. This DPA shall be effective as of the date the Controller first uses the Service.

The Merchant acts as the Data Controller with respect to Personal Data of its Affiliates, Customers, and its own employees or representatives who use the dashboard. Rezfiliate acts as the Data Processor, processing such data solely on the Merchant's documented instructions, as set out in this DPA and the Principal Agreement. The parties acknowledge that Rezfiliate is processing data on behalf of the Merchant and not for its own purposes, except as explicitly stated in the Privacy Policy for Controller Data (e.g., billing and account management).

The processing of Personal Data by the Processor relates to the following:

• Subject-matter: Provision of the Rezfiliate affiliate program management platform, including referral attribution, commission calculation, and analytics dashboards.
• Duration: For the term of the Principal Agreement and thereafter only for the period required to complete deletion or return, comply with law, resolve disputes, prevent fraud, complete payment or accounting records, or establish, exercise, or defend legal claims. Controller data that Rezfiliate processes for its own billing or account-management purposes is governed by the Privacy Policy rather than this DPA.
• Nature and Purpose: Attribution of affiliate referrals; calculation and routing of commission payouts; generating analytics reports for the Merchant; and enabling the Merchant to manage their affiliate program.
• Types of Personal Data:
  • Affiliate Data: Name, email address, authentication identifiers, Stripe connected-account identifiers and payout metadata, referral activity, commission history, and tax or compliance information provided to a payment provider.
  • Customer and conversion data: Referral and click identifiers, referral-code and discount-code values, order or subscription identifiers, amounts and currency, country, referrer, user agent, IP address, fraud signals, and other conversion data configured or received through a Merchant integration.
  • Merchant employee/representative data: Name, email address, authentication identifiers, and other account details used for dashboard access.
• Categories of Data Subjects:
  • Affiliates (individual partners promoting the Merchant's products).
  • Customers (end-users who make purchases via affiliate links).
  • Merchant employees and representatives who use the Service.

The Processor shall process Personal Data only on documented instructions from the Controller, unless required by applicable law to do otherwise (in which case the Processor shall inform the Controller of that legal requirement before processing, unless prohibited by law). The initial instructions are set out in this DPA and the Principal Agreement. The Controller may issue additional written instructions during the term, which the Processor will implement where technically and operationally feasible.

The Processor shall ensure that any person (including employees, contractors, and sub-processors) authorised to process Personal Data is subject to a binding duty of confidentiality. This obligation shall apply during their engagement and continue indefinitely after their engagement ends.

The Processor shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Access controls, authentication, least-privilege practices, and confidentiality obligations appropriate to the Service.
• Encryption and secure transmission measures where appropriate to the data and risk.
• Logging, monitoring, backups, patching, and incident-response procedures appropriate to the Service.
• Business continuity and recovery measures appropriate to the Service and its risks.
• Periodic review and improvement of technical and organisational safeguards.

The Processor will not materially reduce the overall security of the Service without prior written notice to the Controller.

The Controller grants a general written authorisation for the Processor to engage sub-processors listed in Schedule A (below). The Processor shall:

• Notify the Controller in writing at least 14 days before engaging any new sub-processor, providing the name, location, and processing activities of the proposed sub-processor.
• Allow the Controller a reasonable objection period (14 days from notification), during which the Controller may object on legitimate grounds relating to data protection. The Processor will make commercially reasonable efforts to accommodate such objections.
• If the Controller objects to a new sub-processor on legitimate grounds and the Processor cannot reasonably accommodate the objection, the Controller may terminate the Principal Agreement without penalty.
• Bind each sub-processor in a written contract that imposes the same (or equivalent) data protection obligations as set out in this DPA, particularly providing sufficient guarantees of technical and organisational security measures.
• Remain fully liable to the Controller for the performance of sub-processors and for any breaches of this DPA caused by a sub-processor.

Schedule A - Current Sub-processors:

• Stripe (subscription billing, payment processing, connected accounts, transfers, and payouts) - location and transfer terms depend on the Stripe service and account.
• Hetzner (cloud infrastructure and database hosting) - current primary hosting is in Germany, subject to provider configuration.
• Backblaze B2 (object storage for uploaded assets) - location depends on the selected bucket and provider configuration.
• SMTP/email provider (service and transactional email delivery) - provider and location must be kept current in the published subprocessor list.
• Authentication and ecommerce integration providers (Google, Facebook, GitHub, Shopify, BigCommerce, WooCommerce, and other enabled integrations) - only where used by the Controller or its users.

The Processor shall provide the Controller with reasonable assistance (taking into account the nature of processing) in fulfilling the Controller's obligations to respond to requests from data subjects exercising their rights under Chapter III of the GDPR (access, rectification, erasure, restriction, objection, portability). Such assistance shall include:

• Providing a copy of the relevant Personal Data held by the Processor within 10 business days of the Controller's request.
• Rectifying or deleting data upon the Controller's documented instruction.
• Notifying the Controller of any direct requests received by the Processor from a data subject (the Processor will not respond directly without the Controller's authorisation).

The Processor will respond to the Controller's requests for assistance within 10 business days. The Processor may charge a reasonable fee for assistance that goes beyond its standard service offering, subject to prior agreement.

The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting Personal Data processed on behalf of the Controller. The Processor will target notification within 72 hourswhere reasonably practicable, but the absence of complete information will not delay an initial notice. The notification will include:

• The nature of the breach (including categories and approximate number of data subjects and records).
• The likely consequences of the breach.
• The measures taken or proposed to mitigate the breach.
• A point of contact for further information.

The Processor will cooperate with the Controller in investigating the breach and will provide reasonable assistance in notifying supervisory authorities and affected data subjects, as required by law.

Upon termination or expiry of the Principal Agreement, the Processor shall, at the Controller's option, delete or return all Personal Data processed on behalf of the Controller. The Processor shall delete or anonymize existing copies of Personal Data unless retention is required by applicable law or legitimate business, transaction, financial, or security record-keeping needs. If retention is required, the Processor shall inform the Controller and process such data solely to the extent and for the duration required.

Deletion Timeline: Upon the Controller's scheduled account deletion, application data is placed into the Service's deletion workflow, which currently schedules user deletion approximately twelve (12) days after the request. Some Merchant program, payout, accounting, security, backup, or dispute records may remain where needed for legal, payment, fraud-prevention, or record-keeping purposes. The Processor will not use retained data for unrelated purposes and will delete or anonymize it when the retention reason ends.

The Controller (or an independent third-party auditor mandated by the Controller and subject to confidentiality obligations) may audit the Processor's compliance with this DPA. Such audits shall:

• Be conducted upon reasonable notice (at least 30 days).
• Be carried out during normal business hours.
• Not unreasonably interfere with the Processor's operations.
• Be limited to once per calendar year, unless there is a documented data breach or a regulatory requirement.

The Processor shall provide reasonable assistance and access to relevant documentation (e.g., security policies, SOC 2 / ISO certifications, and sub-processor contracts, redacted for confidentiality) to demonstrate compliance.

Audit Alternative: The Processor may satisfy the Controller's audit right by providing a third-party audit report (e.g., SOC 2 Type II or equivalent) conducted within the preceding 12 months, in lieu of an on-site audit or inspection of premises and records.

Personal Data may be processed in Canada, the European Economic Area, the United Kingdom, the United States, and other countries where an authorised sub-processor operates. Where an adequacy decision does not apply to a transfer, the Processor will implement an approved transfer mechanism, such as the EU Standard Contractual Clauses or UK International Data Transfer Addendum, together with any required transfer assessment and supplementary measures, and will notify the Controller in accordance with Section 7.

The Processor's liability to the Controller for damages arising out of or in connection with this DPA shall be subject to the limitations, exclusions, indemnities, and non-waivable-law carve-outs in the Principal Agreement, except to the extent applicable law requires a different allocation. The parties will cooperate in good faith regarding regulator claims, data subject claims, and subprocessor responsibility; this paragraph does not promise that any contractual cap or indemnity will be enforceable against a regulator or data subject.

Any dispute, claim, or controversy arising out of or relating to this DPA shall be resolved in accordance with the dispute resolution provisions in the Principal Agreement, which include mandatory arbitration, a small claims court carve-out, a class action waiver, and the 30-day arbitration opt-out.

Governing Law: This DPA shall be governed by the laws of the Province of Ontario, Canada, without regard to conflict of law principles. For Merchants located in the EU or UK, mandatory data protection laws of their jurisdiction shall also apply.